spree_cm_commissioner 2.9.6 → 2.9.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f187ec143a0546d2099b322062ef981cac276ced2ef0ae9714bd5d5984040d2c
-  data.tar.gz: 1f2a838ce0779597fd0c5b06784b9e0fbb260085457612dcb7e646f61da0482b
+  metadata.gz: e267212ae81075d66a95e65c2eb320ea05bc9b18f53b1bc4a74896639ddd4ed2
+  data.tar.gz: cc28b8d31dd89f481864b6f5c366d264335403ca4f8aaf9a00dbd39e502012b6
 SHA512:
-  metadata.gz: 9f722ef15d8fef51009e1da877520831551d33d4c2391036dcd31db1ddc6f485cc0d475b6144843fb660404e7e75ecfb77769a646bc6933378b4eca181cadfaa
-  data.tar.gz: 8ef07513d2cb8b65635dfa960b60d84fdbb6d0ad2731cc098f3e99de64901bd3100e80b9a10c0ac1e1243a4c451f2633b93ca3496775f690b10bd6edc2f66369
+  metadata.gz: 7cb85b5d8aaac69dc845ddeb068ec96200cf400a7c6d9f3bd979681fe4d03dd08cf4358a059855825785d9524e1a4d04e0447e3b0bfc682f4827c1b09734fa7d
+  data.tar.gz: 5727d1541df27c51c58ef2b4a7e022096c62aa6666fcb58514dbe39621a44395478d1f5ea5ecef24280767c0d41f47e43f823276720ce63f45c7ef371278b0a8

data/.env.example

@@ -32,14 +32,9 @@ WAITING_ROOM_MAX_ETA_BATCH_SIZE=50 # cap on batch size assumed when estimating t
 VATTANAC_AES_SECRET_KEY= ""
 VATTANAC_PUBLIC_KEY=""
 
-# Telegram OAuth (OpenID Connect) login.
-# client_id (audience) the mobile app uses when requesting an id_token from
-# Telegram. Verified as the `aud` claim in
-# app/interactors/spree_cm_commissioner/telegram_oauth_id_token_provider.rb
-TELEGRAM_OAUTH_CLIENT_ID=""
-# client_secret injected server-side when proxying the PKCE code -> id_token
-# exchange in app/interactors/spree_cm_commissioner/telegram_oauth_token_exchanger.rb
-TELEGRAM_OAUTH_CLIENT_SECRET=""
+# Telegram OAuth (OpenID Connect) login client_id/client_secret are configured
+# per tenant (or on the default store for tenant-less logins) from the admin
+# under Telegram Authentication - see docs/authentication/telegram-login.md.
 
 # Organizer URL
 ORGANIZER_URL=http://127.0.0.1:4000/organizer

data/Gemfile.lock

@@ -34,7 +34,7 @@ GIT
 PATH
   remote: .
   specs:
-    spree_cm_commissioner (2.9.6)
+    spree_cm_commissioner (2.9.7)
       activerecord-multi-tenant
       activerecord_json_validator (~> 2.1, >= 2.1.3)
       aws-sdk-cloudfront

data/app/controllers/spree/admin/users_controller_decorator.rb

@@ -20,8 +20,26 @@ module Spree
         end
       end
 
+      # override
+      def update
+        preserve_non_form_roles
+        super
+      end
+
       private
 
+      # Role types the user form doesn't render (assigned in organizer dashboards), e.g. check-in groups and preview.
+      NON_FORM_ROLE_TYPES = %i[check_in preview].freeze
+
+      # spree_role_ids= replaces the whole role set, so a submit that omits these would drop them. Merge
+      # the user's existing ones back in so they survive. Skip when the form didn't submit roles at all.
+      def preserve_non_form_roles
+        return if params.dig(:user, :spree_role_ids).nil?
+
+        preserved_ids = @user.spree_roles.where(role_type: NON_FORM_ROLE_TYPES).pluck(:id).map(&:to_s)
+        params[:user][:spree_role_ids] = (params[:user][:spree_role_ids] + preserved_ids).uniq
+      end
+
       def build_profile
         return unless permitted_resource_params[:profile]
 

data/app/controllers/spree/api/v2/storefront/telegram_oauth_tokens_controller.rb

@@ -9,7 +9,11 @@ module Spree
         # has no access token yet (this is part of logging in).
         class TelegramOauthTokensController < Spree::Api::V2::BaseController
           def create
-            result = SpreeCmCommissioner::TelegramOauthTokenExchanger.call(exchange_params.to_h.symbolize_keys)
+            return render_error_payload(credential_mismatch_message) if credential_mismatch_message
+
+            result = SpreeCmCommissioner::TelegramOauthTokenExchanger.call(
+              exchange_params.merge(client_secret: resolved_client_secret)
+            )
 
             return render_error_payload(result.message) unless result.success?
 
@@ -19,7 +23,36 @@ module Spree
           private
 
           def exchange_params
-            params.permit(:client_id, :code, :redirect_uri, :code_verifier)
+            params.permit(:client_id, :code, :redirect_uri, :code_verifier).to_h.symbolize_keys
+          end
+
+          # `tenant_id` scopes which tenant's bot this login belongs to; with none
+          # given, the default store's bot is used. Distinguished from
+          # telegram_oauth_client_secret_not_configured (raised by the exchanger
+          # when the owner has no secret set) so a caller can tell "wrong
+          # tenant/client_id" apart from "correct tenant, nothing configured yet".
+          def credential_mismatch_message
+            return 'telegram_oauth_tenant_not_found' if params[:tenant_id].present? && credential_owner.nil?
+            return nil if credential_owner.nil? || credential_owner.preferred_telegram_oauth_client_id.blank?
+            return 'telegram_oauth_client_id_mismatch' unless client_id_matches_owner?
+
+            nil
+          end
+
+          def client_id_matches_owner?
+            credential_owner.preferred_telegram_oauth_client_id == exchange_params[:client_id]
+          end
+
+          def resolved_client_secret
+            credential_owner&.preferred_telegram_oauth_client_secret.presence
+          end
+
+          def credential_owner
+            @credential_owner ||= if params[:tenant_id].present?
+                                    SpreeCmCommissioner::Tenant.find_by(id: params[:tenant_id])
+                                  else
+                                    Spree::Store.default
+                                  end
           end
         end
       end

data/app/controllers/spree/api/v2/tenant/order_histories_controller.rb

@@ -43,6 +43,7 @@ module Spree
             # It related to user cancel or complete order flow, which relies on the most recent orders being returned first.
             if spree_current_user.present?
               spree_current_user.orders
+                                .exclude_vote_package
                                 .not_archived
                                 .incomplete
                                 .order(id: :desc)
@@ -51,6 +52,7 @@ module Spree
               return Spree::Order.none if order_tokens.empty?
 
               Spree::Order.not_archived
+                          .exclude_vote_package
                           .incomplete
                           .without_user
                           .where(token: order_tokens)

data/app/finders/spree_cm_commissioner/routes/find.rb

@@ -21,7 +21,7 @@ module SpreeCmCommissioner
         @destination_place_id = @params.dig(:filter, :destination_place_id)
         @query = @params.dig(:filter, :query) || @params[:query]
         @limit = (@params[:limit] || @params.dig(:page, :limit) || 50).to_i
-        @order = @params[:order] || 'created_at DESC'
+        @order = @params[:order] || 'created_at ASC'
       end
 
       def execute

data/app/interactors/spree_cm_commissioner/telegram_oauth_id_token_provider.rb

@@ -15,14 +15,12 @@ module SpreeCmCommissioner
     # "oidc-1") by default.
     SUPPORTED_ALGORITHMS = %w[RS256 ES256].freeze
 
-    # :id_token
+    # :id_token, :client_id
     def call
       context.fail!(message: 'telegram_id_token_missing') if context.id_token.blank?
+      context.fail!(message: 'telegram_oauth_client_id_not_configured') if context.client_id.blank?
 
-      audience = expected_audience
-      context.fail!(message: 'telegram_oauth_client_id_not_configured') if audience.blank?
-
-      claim = decode_id_token(audience)
+      claim = decode_id_token(context.client_id)
       return if claim.nil?
 
       context.claim = claim
@@ -83,10 +81,6 @@ module SpreeCmCommissioner
       context.fail!(message: 'telegram_jwks_fetch_failed', error: e.message)
     end
 
-    def expected_audience
-      ENV['TELEGRAM_OAUTH_CLIENT_ID'].presence
-    end
-
     # sub is the Telegram user id (also the chat id once the user has /started
     # the bot), which keeps OIDC logins consistent with the Telegram Web App
     # flow that also keys UserIdentityProvider.telegram on the Telegram user id.

data/app/interactors/spree_cm_commissioner/telegram_oauth_token_exchanger.rb

@@ -12,13 +12,17 @@ module SpreeCmCommissioner
   # still requires `client_secret`, which is why it must be injected here
   # server-side rather than sent by the app.
   #
+  # `client_secret` is resolved by the caller (which has tenant context from
+  # the request) and passed in like any other param - this interactor only
+  # forwards it to Telegram, it never looks up a tenant/store itself.
+  #
   # Docs: https://core.telegram.org/bots/telegram-login
   class TelegramOauthTokenExchanger < BaseInteractor
     TOKEN_ENDPOINT = 'https://oauth.telegram.org/token'.freeze
 
     REQUIRED_PARAMS = %i[client_id code redirect_uri code_verifier].freeze
 
-    delegate :client_id, :code, :redirect_uri, :code_verifier, to: :context
+    delegate :client_id, :client_secret, :code, :redirect_uri, :code_verifier, to: :context
 
     def call
       missing = REQUIRED_PARAMS.find { |key| context[key].blank? }
@@ -33,10 +37,6 @@ module SpreeCmCommissioner
 
     private
 
-    def client_secret
-      ENV['TELEGRAM_OAUTH_CLIENT_SECRET'].presence
-    end
-
     def post_to_telegram
       uri = URI(TOKEN_ENDPOINT)
       request = Net::HTTP::Post.new(uri)

data/app/interactors/spree_cm_commissioner/user_telegram_oauth_authenticator.rb

@@ -19,12 +19,22 @@ module SpreeCmCommissioner
     private
 
     def verified_provider
-      result = SpreeCmCommissioner::TelegramOauthIdTokenProvider.call(id_token: id_token)
+      result = SpreeCmCommissioner::TelegramOauthIdTokenProvider.call(id_token: id_token, client_id: telegram_client_id)
       context.fail!(message: result.message) unless result.success?
 
       result.provider
     end
 
+    # Each tenant runs its own Telegram bot, so the audience an id_token must
+    # carry is looked up on the tenant directly - no default-store or ENV
+    # fallback, so a misconfigured tenant fails loudly instead of silently
+    # authenticating against someone else's bot.
+    def telegram_client_id
+      return Spree::Store.default.preferred_telegram_oauth_client_id if tenant_id.blank?
+
+      SpreeCmCommissioner::Tenant.find_by(id: tenant_id)&.preferred_telegram_oauth_client_id
+    end
+
     def find_or_register_user(provider)
       identity_checker = SpreeCmCommissioner::UserIdentityChecker.call(
         identity_type: provider[:identity_type],

data/app/mailers/spree/order_mailer_decorator.rb

@@ -3,6 +3,7 @@ module Spree
     def cancel_email(order, resend: false)
       @order = order.respond_to?(:id) ? order : Spree::Order.find(order)
       return false if @order.email.blank?
+      return false if @order.products.all?(&:vote_package?) # disable cancel email for vote package orders
 
       setup_tenant_and_store
       if @tenant.present?

data/app/models/concerns/spree_cm_commissioner/event_metadata.rb

@@ -21,15 +21,25 @@ module SpreeCmCommissioner
       # ⚠️  CRITICAL: Cached seat layout IDs kept in sync by SeatLayout callback.
       # If callback is removed/modified without updating this, availability checks will fail.
       #
-      # Sync callback (see seat_layout.rb:L26-35):
+      # `preload_seat_layout_ids` is every seat layout ever attached to this event, regardless of
+      # status — kept for callers that need the full history/count. `preload_active_seat_layout_ids`
+      # is the subset with status `active`, so consumers checking "can this still be booked?"
+      # (e.g. hasSeatSelection on the app) should use that one instead — deactivating/archiving a
+      # layout removes it from this list even though it stays in `preload_seat_layout_ids`.
+      #
+      # Sync callback (see seat_layout.rb:L32-44):
       #   after_commit :sync_seat_layout_id_to_layoutable!, if: -> { layoutable.present? }
       #   def sync_seat_layout_id_to_layoutable!
-      #     layoutable.update!(preload_seat_layout_ids: layoutable.seat_layouts.pluck(:id))
+      #     layoutable.update!(
+      #       preload_seat_layout_ids: layoutable.seat_layouts.pluck(:id),
+      #       preload_active_seat_layout_ids: layoutable.seat_layouts.active.pluck(:id)
+      #     )
       #   end
       #
       # TODO: Not scalable for many seat layouts. Consider storing boolean flag
       # (has_active_seat_layout) instead when seat layouts become frequent.
       store_public_metadata :preload_seat_layout_ids, :array, default: []
+      store_public_metadata :preload_active_seat_layout_ids, :array, default: []
 
       before_validation :validate_at_least_one_check_in_flow_presence
     end

data/app/models/concerns/spree_cm_commissioner/order_state_machine.rb

@@ -281,6 +281,8 @@ module SpreeCmCommissioner
     end
 
     def notify_order_complete_app_notification_to_user
+      return if products.all?(&:vote_package?) # disable app push notification for vote package orders
+
       SpreeCmCommissioner::OrderCompleteNotificationSender.call(order: self)
     end
 

data/app/models/concerns/spree_cm_commissioner/store_preference.rb

@@ -11,6 +11,8 @@ module SpreeCmCommissioner
       preference :telegram_order_anomaly_alert_chat_id, :string
       preference :assetlinks, :string, default: ''
       preference :apple_app_site_association, :string, default: ''
+      preference :telegram_oauth_client_id, :string, default: ''
+      preference :telegram_oauth_client_secret, :string, default: ''
     end
   end
 end

data/app/models/concerns/spree_cm_commissioner/tenant_preference.rb

@@ -15,6 +15,8 @@ module SpreeCmCommissioner
       preference :facebook, :string, default: ''
       preference :twitter, :string, default: ''
       preference :instagram, :string, default: ''
+      preference :telegram_oauth_client_id, :string, default: ''
+      preference :telegram_oauth_client_secret, :string, default: ''
     end
   end
 end

data/app/models/spree_cm_commissioner/seat_layout.rb

@@ -33,11 +33,19 @@ module SpreeCmCommissioner
       # Update layoutable's seat layout metadata after any change (create/update/destroy).
       # This keeps the cache in sync with the actual seat_layouts association.
       if layoutable.respond_to?(:seat_layouts)
-        # Event has many seat layouts: cache all IDs for quick availability checks.
-        layoutable.update!(preload_seat_layout_ids: layoutable.seat_layouts.pluck(:id))
+        # Event has many seat layouts: `..._ids` caches every layout ever attached (any status);
+        # `active_..._ids` caches only the `active` ones, for callers checking bookability.
+        layoutable.update!(
+          preload_seat_layout_ids: layoutable.seat_layouts.pluck(:id),
+          preload_active_seat_layout_ids: layoutable.seat_layouts.active.pluck(:id)
+        )
       elsif layoutable.respond_to?(:seat_layout)
-        # Taxon/Vehicle has single seat layout: cache the ID (or nil if destroyed).
-        layoutable.update!(preload_seat_layout_id: destroyed? ? nil : id)
+        # Taxon/Vehicle has single seat layout: cache the ID (or nil if destroyed); the active
+        # variant is also nil while the layout is inactive/archived, not just when destroyed.
+        layoutable.update!(
+          preload_seat_layout_id: destroyed? ? nil : id,
+          preload_active_seat_layout_id: destroyed? || !active? ? nil : id
+        )
       end
     end
   end

data/app/models/spree_cm_commissioner/show.rb

@@ -13,7 +13,9 @@ module SpreeCmCommissioner
     has_many :vote_packages, -> { where(product_type: :vote_package) }, class_name: 'SpreeCmCommissioner::ShowEpisode', foreign_key: :event_id
     has_many :voting_sessions, through: :episodes, class_name: 'SpreeCmCommissioner::VotingSession'
 
-    has_one :current_episode, -> { current_or_next_upcoming }, class_name: 'SpreeCmCommissioner::ShowEpisode', foreign_key: :event_id
+    has_one :current_episode, lambda {
+                                current_or_next_upcoming.where(status: :active)
+                              }, class_name: 'SpreeCmCommissioner::ShowEpisode', foreign_key: :event_id
     has_one :current_voting_session, through: :current_episode
 
     before_validation { self.type = self.class.name }

data/app/models/spree_cm_commissioner/show_episode.rb

@@ -17,7 +17,9 @@ module SpreeCmCommissioner
              primary_key: :event_id
     has_many :contestants, through: :season, source: :show_contestants
 
-    has_one :current_voting_session, -> { current_or_next_upcoming }, class_name: 'SpreeCmCommissioner::VotingSession', foreign_key: :episode_id
+    has_one :current_voting_session, lambda {
+                                       current_or_next_upcoming.where.not(status: :disabled)
+                                     }, class_name: 'SpreeCmCommissioner::VotingSession', foreign_key: :episode_id
 
     validates :ends_at, presence: true, if: -> { product_type == 'show_episode' }
 

data/app/models/spree_cm_commissioner/trip.rb

@@ -8,10 +8,15 @@ module SpreeCmCommissioner
 
     enum trip_type: { direct: 0, multi_leg: 1 }
 
+    # public: shown in trip search results; unpublic: hidden from search (kept for the owning vendor).
+    # _prefix avoids generating a bare `public?` / `Trip.public` that would collide with Ruby's `public`.
+    enum visibility: { public: 0, unpublic: 1 }, _prefix: true, _default: :public
+
     # This model has no seat_layout column (polymorphic association), so we store the preload_seat_layout_id ID in public_metadata.
     # This lets us check if a seat layout exists without triggering a database query.
     # The ID is automatically updated whenever the seat_layout is saved.
     store_public_metadata :preload_seat_layout_id, :integer
+    store_public_metadata :preload_active_seat_layout_id, :integer
 
     # Trip: array of offsets for each leg # => [0, 1, 2]
     # Usage: trip.preload_offset_days_array[0] # => 0

data/app/models/spree_cm_commissioner/vehicle_type.rb

@@ -7,6 +7,7 @@ module SpreeCmCommissioner
     # This lets us check if a seat layout exists without triggering a database query.
     # The ID is automatically updated whenever the seat_layout is saved.
     store_public_metadata :preload_seat_layout_id, :integer
+    store_public_metadata :preload_active_seat_layout_id, :integer
 
     attr_accessor :enable_seat_layout
 

data/app/overrides/spree/admin/stores/_form/telegram_auth.html.erb.deface

@@ -0,0 +1,73 @@
+<!-- insert_bottom "[data-hook='admin_store_form_fields']" -->
+
+<% if @store.persisted? %>
+  <%
+    telegram_client_id = @store.preferred_telegram_oauth_client_id.presence
+    telegram_client_secret = @store.preferred_telegram_oauth_client_secret.presence
+    telegram_configured = telegram_client_id.present? && telegram_client_secret.present?
+    telegram_partial = telegram_client_id.present? ^ telegram_client_secret.present?
+  %>
+  <div class="card mb-4">
+    <div class="card-header d-flex flex-wrap align-items-center justify-content-between">
+      <h5 class="card-title mb-0 h6">Telegram Authentication</h5>
+      <% if telegram_configured %>
+        <span class="badge badge-success">Using this store's bot</span>
+      <% elsif telegram_partial %>
+        <span class="badge badge-warning">Incomplete</span>
+      <% else %>
+        <span class="badge badge-danger">Not configured</span>
+      <% end %>
+    </div>
+    <div class="card-body">
+      <div id="telegram-auth-settings" data-hook class="form-group mb-0">
+        <div class="row">
+          <!-- Telegram OAuth Client ID -->
+          <div class="col-md-6">
+            <%= f.field_container :preferred_telegram_oauth_client_id do %>
+              <%= f.label :preferred_telegram_oauth_client_id, 'Client ID' %>
+              <%= f.text_field :preferred_telegram_oauth_client_id, class: 'form-control text-monospace',
+                    placeholder: 'e.g. 7123456789', autocomplete: 'off' %>
+              <small class="form-text text-muted">Bot ID &mdash; digits before the colon in the BotFather token.</small>
+              <%= f.error_message_on :preferred_telegram_oauth_client_id %>
+            <% end %>
+          </div>
+
+          <!-- Telegram OAuth Client Secret -->
+          <div class="col-md-6">
+            <%= f.field_container :preferred_telegram_oauth_client_secret do %>
+              <%= f.label :preferred_telegram_oauth_client_secret, 'Client Secret' %>
+              <div class="input-group">
+                <%= f.password_field :preferred_telegram_oauth_client_secret,
+                      class: 'form-control text-monospace', id: 'store_telegram_oauth_client_secret',
+                      autocomplete: 'new-password', value: f.object.preferred_telegram_oauth_client_secret %>
+                <div class="input-group-append">
+                  <button type="button" class="btn btn-outline-secondary"
+                          data-telegram-secret-toggle="store_telegram_oauth_client_secret">
+                    Show
+                  </button>
+                </div>
+              </div>
+              <small class="form-text text-muted">From BotFather. Server-side only &mdash; never sent to the app.</small>
+              <%= f.error_message_on :preferred_telegram_oauth_client_secret %>
+            <% end %>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+
+  <script>
+    (function () {
+      document.querySelectorAll('[data-telegram-secret-toggle]').forEach(function (button) {
+        button.addEventListener('click', function () {
+          var field = document.getElementById(button.dataset.telegramSecretToggle);
+          if (!field) return;
+
+          var hidden = field.type === 'password';
+          field.type = hidden ? 'text' : 'password';
+          button.textContent = hidden ? 'Hide' : 'Show';
+        });
+      });
+    })();
+  </script>
+<% end %>

data/app/queries/spree_cm_commissioner/multi_leg_trips_query.rb

@@ -135,6 +135,11 @@ module SpreeCmCommissioner
       scope = scope.where(parent: { route_type: SpreeCmCommissioner::Trip.route_types[route_type] }) if route_type.present?
       scope = scope.where(parent: { vendor_id: vendor_id }) if vendor_id.present?
 
+      # Hide unpublished trips from search: filter both the leg (cm_trips) and the parent trip.
+      public_visibility = SpreeCmCommissioner::Trip.visibilities[:public]
+      scope = scope.visibility_public # filters cm_trips (the leg)
+      scope = scope.where(parent: { visibility: public_visibility })
+
       if tenant_id.present?
         scope = scope.joins('INNER JOIN spree_vendors v ON v.id = parent.vendor_id')
                      .where(v: { tenant_id: tenant_id })

data/app/queries/spree_cm_commissioner/single_leg_trips_query.rb

@@ -50,7 +50,8 @@ module SpreeCmCommissioner
 
     def direct_trips # rubocop:disable Metrics/MethodLength
       # Build base conditions
-      base_conditions = { trip_type: :direct }
+      # visibility: :public hides unpublished trips from search results
+      base_conditions = { trip_type: :direct, visibility: :public }
       base_conditions[:vendor_id] = vendor_id if vendor_id.present?
       base_conditions[:route_type] = route_type if route_type.present?
       base_conditions[:spree_vendors] = { tenant_id: tenant_id } if tenant_id.present?

data/app/serializers/spree/v2/storefront/taxon_serializer_decorator.rb

@@ -22,6 +22,7 @@ module Spree
 
           # To get full seat layout details, call the seat_layouts API with this ID.
           base.attribute :seat_layout_ids, &:preload_seat_layout_ids
+          base.attribute :active_seat_layout_ids, &:preload_active_seat_layout_ids
 
           base.attribute :purchasable_on_app do |taxon|
             taxon.purchasable_on == 'app' || taxon.purchasable_on == 'both'

data/app/services/spree_cm_commissioner/voting_leaderboards/time_range_result.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+# Aggregates vote counts for a voting session restricted to a created_at window.
+#
+# Redis counters and the finalized DB snapshot are both cumulative — they hold no time
+# dimension — so any time-filtered leaderboard has to be recomputed from cm_votes.
+# This service is the DB-backed equivalent of VoteCounters::PerContestantCounter and
+# returns the exact same value shape so callers can swap between them.
+#
+# from / to are inclusive-exclusive (created_at >= from, created_at < to) so that
+# adjacent windows never double-count a vote sitting on the boundary.
+#
+# Usage:
+#   SpreeCmCommissioner::VotingLeaderboards::TimeRangeResult.call(
+#     voting_session_id: session.id,
+#     from: 1.hour.ago,
+#     to:   Time.current
+#   ).value
+#   # => { counts: { 12 => 40 }, unique_voters: 7, unique_voters_per_contestant: { 12 => 7 } }
+module SpreeCmCommissioner
+  module VotingLeaderboards
+    class TimeRangeResult
+      prepend ::Spree::ServiceModule::Base
+
+      EMPTY_RESULT = {
+        counts: {}.freeze,
+        unique_voters: 0,
+        unique_voters_per_contestant: {}.freeze
+      }.freeze
+
+      def call(voting_session_id:, from: nil, to: nil)
+        return failure(nil, I18n.t('spree_cm_commissioner.voting_leaderboards.time_range_result.invalid_range')) if invalid_range?(from, to)
+
+        ids = contestant_ids(voting_session_id)
+        return success(EMPTY_RESULT) if ids.empty?
+
+        scope = votes_scope(voting_session_id, from, to)
+
+        success(
+          counts: fill(ids, scope.group(:contestant_id).sum(:quantity)),
+          unique_voters: unique_voters(scope),
+          unique_voters_per_contestant: fill(ids, unique_voters_per_contestant(scope))
+        )
+      rescue StandardError => e
+        failure(nil, e.message)
+      end
+
+      private
+
+      def invalid_range?(from, to)
+        from.present? && to.present? && from > to
+      end
+
+      def contestant_ids(voting_session_id)
+        SpreeCmCommissioner::VotingContestant.where(voting_session_id: voting_session_id).pluck(:id)
+      end
+
+      def votes_scope(voting_session_id, from, to)
+        scope = SpreeCmCommissioner::Vote.where(voting_session_id: voting_session_id)
+        scope = scope.where(created_at: from..) if from.present?
+        scope = scope.where(created_at: ...to)  if to.present?
+        scope
+      end
+
+      def unique_voters(scope)
+        scope.where.not(user_id: nil).distinct.count(:user_id)
+      end
+
+      def unique_voters_per_contestant(scope)
+        scope.where.not(user_id: nil).group(:contestant_id).distinct.count(:user_id)
+      end
+
+      # Contestants with no votes in the window must still appear with zeros.
+      def fill(ids, rows)
+        ids.index_with { |id| rows.fetch(id, 0) }
+      end
+    end
+  end
+end

data/app/views/spree/admin/tenants/_form.html.erb

@@ -223,6 +223,33 @@
   </div>
 </div>
 
+<!-- ======================== Telegram Authentication ======================== -->
+<%
+  telegram_client_id = f.object.preferred_telegram_oauth_client_id.presence
+  telegram_client_secret = f.object.preferred_telegram_oauth_client_secret.presence
+  telegram_configured = telegram_client_id.present? && telegram_client_secret.present?
+  telegram_partial = telegram_client_id.present? ^ telegram_client_secret.present?
+%>
+<div class="card mb-4">
+  <div class="card-body">
+    <div data-hook="admin_tenant_form_fields" class="row mt-4">
+      <div class="col-12 mb-4 d-flex flex-wrap align-items-center justify-content-between">
+        <h4 class="mb-0">Telegram Authentication <span class="text-muted" style="font-size: 1rem; font-weight: normal;">(sign customers in with this tenant's own Telegram bot)</span></h4>
+        <% if telegram_configured %>
+          <span class="badge badge-success">Using this tenant's bot</span>
+        <% elsif telegram_partial %>
+          <span class="badge badge-warning">Incomplete</span>
+        <% else %>
+          <span class="badge badge-danger">Not configured</span>
+        <% end %>
+      </div>
+      <div class="col-12">
+        <%= render partial: 'spree/admin/tenants/form/telegram_auth', locals: { f: f } %>
+      </div>
+    </div>
+  </div>
+</div>
+
 <!-- ======================== Redirect Settings ======================== -->
 <div class="card mb-4">
   <div class="card-body">

data/app/views/spree/admin/tenants/form/_telegram_auth.html.erb

@@ -0,0 +1,61 @@
+<%
+  telegram_partial = f.object.preferred_telegram_oauth_client_id.presence.present? ^
+                      f.object.preferred_telegram_oauth_client_secret.presence.present?
+%>
+<div data-hook="admin_tenant_telegram_auth_fields">
+  <% if telegram_partial %>
+    <p class="text-warning small mb-3">
+      Both fields are required &mdash; with only one filled in, login will fail for this tenant.
+    </p>
+  <% end %>
+
+  <div class="row">
+    <div class="col-md-6">
+      <%= f.field_container :preferred_telegram_oauth_client_id do %>
+        <%= f.label :preferred_telegram_oauth_client_id, 'Client ID' %>
+        <%= f.text_field :preferred_telegram_oauth_client_id, class: 'form-control text-monospace',
+              placeholder: 'e.g. 7123456789', autocomplete: 'off' %>
+        <small class="form-text text-muted">Bot ID &mdash; digits before the colon in the BotFather token.</small>
+        <% if f.object.errors[:preferred_telegram_oauth_client_id].any? %>
+          <div class="error text-danger"><%= f.object.errors[:preferred_telegram_oauth_client_id].join(', ') %></div>
+        <% end %>
+      <% end %>
+    </div>
+
+    <div class="col-md-6">
+      <%= f.field_container :preferred_telegram_oauth_client_secret do %>
+        <%= f.label :preferred_telegram_oauth_client_secret, 'Client Secret' %>
+        <div class="input-group">
+          <%= f.password_field :preferred_telegram_oauth_client_secret,
+                class: 'form-control text-monospace', id: 'tenant_telegram_oauth_client_secret',
+                autocomplete: 'new-password', value: f.object.preferred_telegram_oauth_client_secret %>
+          <div class="input-group-append">
+            <button type="button" class="btn btn-outline-secondary"
+                    data-telegram-secret-toggle="tenant_telegram_oauth_client_secret">
+              Show
+            </button>
+          </div>
+        </div>
+        <small class="form-text text-muted">From BotFather. Server-side only &mdash; never sent to the app.</small>
+        <% if f.object.errors[:preferred_telegram_oauth_client_secret].any? %>
+          <div class="error text-danger"><%= f.object.errors[:preferred_telegram_oauth_client_secret].join(', ') %></div>
+        <% end %>
+      <% end %>
+    </div>
+  </div>
+</div>
+
+<script>
+  (function () {
+    document.querySelectorAll('[data-telegram-secret-toggle]').forEach(function (button) {
+      button.addEventListener('click', function () {
+        var field = document.getElementById(button.dataset.telegramSecretToggle);
+        if (!field) return;
+
+        var hidden = field.type === 'password';
+        field.type = hidden ? 'text' : 'password';
+        button.textContent = hidden ? 'Hide' : 'Show';
+      });
+    });
+  })();
+</script>

data/config/initializers/spree_permitted_attributes.rb

@@ -71,6 +71,8 @@ module Spree
       :preferred_telegram_order_anomaly_alert_chat_id,
       :preferred_assetlinks,
       :preferred_apple_app_site_association,
+      :preferred_telegram_oauth_client_id,
+      :preferred_telegram_oauth_client_secret,
       { default_notification_image_attributes: {} },
       :term_and_condition_promotion
     ]

data/config/locales/en.yml

@@ -925,6 +925,8 @@ en:
     voting_leaderboards:
       combined_result:
         pre_vote_not_finalized: "Cannot combine results: Pre-Vote sessions not yet finalized: %{names}"
+      time_range_result:
+        invalid_range: "Invalid time range: the start time must be before the end time."
 
   voting:
     errors:

data/config/locales/km.yml

@@ -681,6 +681,9 @@ km:
     voting_contestants:
       assigner:
         not_eliminated: "តែអ្នកចូលប្រកួតដែលត្រូវបានលុបចោលប៉ុណ្ណោះអាចបន្ថែមទៅ Save Contestants session បាន។ %{name} មានស្ថានភាព %{status}។"
+    voting_leaderboards:
+      time_range_result:
+        invalid_range: "ចន្លោះពេលមិនត្រឹមត្រូវ៖ ពេលចាប់ផ្តើមត្រូវតែមុនពេលបញ្ចប់។"
   voting:
     errors:
       no_winners_confirmed: "មិនមានអ្នកឈ្នះត្រូវបានបញ្ជាក់"

data/db/migrate/20260729000000_add_visibility_to_cm_trips.rb

@@ -0,0 +1,6 @@
+class AddVisibilityToCmTrips < ActiveRecord::Migration[7.0]
+  def change
+    add_column :cm_trips, :visibility, :integer, default: 0, null: false, if_not_exists: true # 0 = public, 1 = unpublic
+    add_index :cm_trips, :visibility, if_not_exists: true
+  end
+end

data/db/migrate/20260729000001_add_session_created_at_index_to_cm_votes.rb

@@ -0,0 +1,12 @@
+# Supports the time-filtered leaderboard (VotingLeaderboards::TimeRangeResult), which runs
+#   WHERE voting_session_id = ? AND created_at >= ? AND created_at < ?
+# grouped by contestant_id.
+#
+# The plain created_at index was dropped in OptimizeCmVotesIndexes because it was never
+# selected on its own; this composite one leads with voting_session_id so the planner can
+# use it for both the session filter and the range scan.
+class AddSessionCreatedAtIndexToCmVotes < ActiveRecord::Migration[7.0]
+  def change
+    add_index :cm_votes, %i[voting_session_id created_at], if_not_exists: true
+  end
+end

data/lib/spree_cm_commissioner/version.rb

@@ -1,5 +1,5 @@
 module SpreeCmCommissioner
-  VERSION = '2.9.6'.freeze
+  VERSION = '2.9.7'.freeze
 
   module_function
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: spree_cm_commissioner
 version: !ruby/object:Gem::Version
-  version: 2.9.6
+  version: 2.9.7
 platform: ruby
 authors:
 - You
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-29 00:00:00.000000000 Z
+date: 2026-08-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: spree
@@ -1889,6 +1889,7 @@ files:
 - app/overrides/spree/admin/stock_locations/index/index.html.erb.deface
 - app/overrides/spree/admin/stores/_form/store_preferences.html.erb.deface
 - app/overrides/spree/admin/stores/_form/store_term_and_condition_promotion.html.erb.deface
+- app/overrides/spree/admin/stores/_form/telegram_auth.html.erb.deface
 - app/overrides/spree/admin/stores/form/_layout/default_notification_image.html.erb.deface
 - app/overrides/spree/admin/taxonomies/_form/kind.html.erb.deface
 - app/overrides/spree/admin/taxons/_form/assets_form.html.erb.deface
@@ -2408,6 +2409,7 @@ files:
 - app/services/spree_cm_commissioner/voting_credits/de_allocate.rb
 - app/services/spree_cm_commissioner/voting_leaderboards/calculate_score.rb
 - app/services/spree_cm_commissioner/voting_leaderboards/combined_result.rb
+- app/services/spree_cm_commissioner/voting_leaderboards/time_range_result.rb
 - app/services/spree_cm_commissioner/voting_sessions/finalize.rb
 - app/services/spree_cm_commissioner/waiting_room/publish_lobby_path.rb
 - app/services/spree_cm_commissioner/waiting_room/stamp_queue_positions.rb
@@ -2636,6 +2638,7 @@ files:
 - app/views/spree/admin/tenants/edit.html.erb
 - app/views/spree/admin/tenants/form/_footer.html.erb
 - app/views/spree/admin/tenants/form/_social.html.erb
+- app/views/spree/admin/tenants/form/_telegram_auth.html.erb
 - app/views/spree/admin/tenants/index.html.erb
 - app/views/spree/admin/tenants/new.html.erb
 - app/views/spree/admin/ticket_transfer_rules/_form.html.erb
@@ -3458,6 +3461,8 @@ files:
 - db/migrate/20260723000000_add_payment_host_to_cm_tenants.rb
 - db/migrate/20260723000001_add_metadata_to_spree_roles.rb
 - db/migrate/20260728074153_add_role_to_cm_exports.rb
+- db/migrate/20260729000000_add_visibility_to_cm_trips.rb
+- db/migrate/20260729000001_add_session_created_at_index_to_cm_votes.rb
 - docker-compose.yml
 - docs/api/scoped-access-token-endpoints.md
 - docs/option_types/attr_types.md